A comparison of /tmp, swap and encryption install time options

Research and document by Mark Krenz
Created: April 11th, 2012
Last update: May 14th, 2013

Summary

On this page I document the results of my research into the default, custom and encryption options for many of the most popular distributions of Linux and the BSDs. I tried my best to include a few versions of some of the most popular ones to show any change in policy. However, I didn't have enough time to install all of them in every combination nor fully install X on some of the distributions. You are most certainly welcome to e-mail me updates to the tables below.

This research is related to the report about the libvte scrollback problem with terminal data being written to disk. After releasing that report, there were several "knowledgeable people" who made uninformed comments such as "most distributions put /tmp on tmpfs by default anyways". This is obviously not true unless you are using the latest version of Arch or unless you have selected an advanced option during install on Mageia or PC Linux OS. Not even Gentoo mentions it in their Handbook or Quick Install Guide. Slackware makes no mention of it in their website. Apparently people missed the memo on tmpfs, the notice about it was on display in the basement of the planning office for the last nine months behind a locked door. ;-)

The focus of this research was on what happens when you choose the default installation options, not what you can do after installation. I think any distribution allows you to install tmpfs after install. For some distributions, I also went on and tried a custom and encrypted install to see the results there. Except for the ones mentioned above, no distribution offered tmpfs as an option during the partitioning stage and anyone who has tmpfs would have had to add it post installation.

Most distributions also default to using gnome-terminal or some other libvte based terminal and I was surprised how many don't offer any other options, such as the xterm. This is a disturbing trend and I'm not sure what the reason is for not including xterm when historically it's always been the most basic terminal option available. xterm is also the most fully capable terminal emulator there is. Sabayon Linux not including vi by default is also just plain weird. I filed a bug report and they said they won't fix it.

Thoughts on tmpfs

In theory tmpfs makes sense but it isn't always a good thing if you're a desktop user. However, I think some people turn it on without completely thinking about the potential consequences. Many GUI programs are designed to recover documents from crashes (ie, Audacity, OpenOffice). Many people like this feature. Probably far more than the number of people who would like to use tmpfs. By default Audacity stores its' data in /tmp and recovers from there in a crash. If someone's system crashed, it would mean losing that recovery data, which I'm sure is not what they wanted to happen.

If you are thinking about turning on tmpfs, you should exercise caution and consider how you use your system and how the programs you use would be affected by losing the data there across a reboot or crash.

One other consideration is that tmpfs is not a perfect solution to fixing the problem of terminal scrollback data being written to /tmp because it is possible for tmpfs data to be swapped out to disk if the kernel decides to do so. Chances are if you're using swap space on your system and run low on memory that your terminal itself may have pages swapped out to disk anyways, but nevertheless it's an issue to consider.

Thoughts on encryption

Encryption is a good thing generally, but I can understand why distributions don't default to having it turned on. Support would be a nightmare for one. No way to recover in the event you forget your password. So it's more of a power user thing than something that should be a default and enforced upon people. In a recent Slashdot poll with 25,813 responses that dated 2011-11-21, it showed that over 49% of people admitted to not encrypting their drives. Slashdot is a subset of geeks and power users on the Internet and has a long history of holding single question polls that help to reveal the geek status quo. In the survey, only 12% of the respondents admited to encrypting more than just their home directory, meaning no more than 12% encrypted their /tmp filesystem. Ubuntu, which is probably the most popular distribution of Linux, only offers a home directory encryption option upon installation.

Encryption of your swap partition is a bit of a no brainer and I can think of no excuse for not using it by default. You should still wipe its' contents along with the drive itself when you're done with it though.

Conclusion

So in conclusion, given that the majority of people are not using tmpfs or encryption and the most popular terminal installed is gnome-terminal, the data breach presented by the flaw in libvte is quite significant and users need to be made aware of it.

Result data

Below are the results of installing distributions in virtual machines and some notes during and after the install process. Boldface in the "Terminals available by default" column indicates the terminals that are available in the menu system. A ? means I didn't fully check. Sorry.